A tiered approach to digital sovereignty

Paul Timmers, Maarten Botterman, and Cristian Hesselman | August 7, 2026

In today's geopolitical landscape, digital sovereignty above all requires action. However, we think it's also useful to have an instrument to meaningfully analyze and discuss this complex notion. We therefore propose a model of digital sovereignty that combines three complementary perspectives, which we refer to as "tiers": strategic autonomy, economic security, and resilience. Our aim is to spark a conversation in the community on the usefulness of such a model. Articulating airtight definitions of the tiers is not our goal at this stage. Looking forward to hearing your thoughts!

Digital sovereignty as a three-tiered concept

The problem we identify is that digital sovereignty is increasingly being used as a broad umbrella term with little attention for its multi-faceted nature, which bears the risk of confused argumentation around the topic.

We therefore propose analyzing the concept of digital sovereignty from three nested perspectives, which we refer to as "tiers": strategic autonomy, economic security, and resilience (see Figure 1). The model shows that resilience is a necessary but insufficient condition for economic security, and so is economic security for strategic autonomy. Paul previously developed a first version of this model, which can also be used for financial sovereignty, energy sovereignty, and other types. We use it for digital sovereignty.

Our three digital sovereignty tiers at a glance

We loosely define the three tiers of Figure 1 as follows, leaving an airtight definition of each to more academic debate:

Digital sovereignty: the ability of a country or alliance of like-minded countries to decide on their own digital future and shape it accordingly (so we're talking about states rather than individual persons). More broadly, effective sovereignty requires what is called "legitimacy", namely external legitimacy (the state is recognized by other states) and internal legitimacy (state and citizens recognize each other). Sovereignty is key in any domain such as economy, society, democracy, defense, and international relations.

Strategic digital autonomy: the means to safeguard digital sovereignty. It consists of three Cs: (1) capabilities (or competences) in the form of knowledge and skills, (2) capacities for production, manufacturing, and services, and (3) control over them to decide on and shape one's own digital future in economy, society, and democracy. Examples are the capabilities (or competences) and capacities of the EU to secure a leading role in industries such as cybersecurity and semiconductors in a globally competitive economy through innovative European business, cutting-edge scientific research on digital systems and networks, and a highly skilled future IT workforce. Another example would be that Europe has under its own control the knowledge and companies to develop products and services that protect its democratic values.

Economic security: involves capabilities and capacities that protect economic assets and that ensure trust in international economic relations and economic (business) continuity free from geo-economic disruption (geo-economics is when economic tools are used for geopolitical purposes). Examples include capabilities and capacities to protect a society's supply chains, energy systems, and digital systems, as illustrated by a recent report of the OECD. Establishing economic security usually requires a close collaboration between private and public organizations, where the former develop and operate digital systems and services and the latter provide oversight.

Resilience: the capacity of a system, be it an individual, a forest, a city or an economy, to deal with change and continue to develop. It is about how humans and nature can use shocks and disturbances like a financial crisis or climate change to spur renewal and innovative thinking. In the digital world, this is about being prepared for disruptions of ecosystems for cloud computing, identity and access management, and Internet naming and routing, amongst others. This is the domain of operators, technical communities, cybersecurity experts, cloud providers and public authorities responsible for continuity.

Added value: explication and richer discussion 

We believe the added value of the tiered model is that it helps explicating the different objectives, owners, stakeholders, and time horizons that digital sovereignty encompasses. For example, securing a globally leading role for the EU in the cloud ecosystem (strategic digital autonomy tier) is a long-term societal objective owned by member states. The stakeholders include future generations of EU citizens and workers, education and research institutes (academic, applied, vocational), funding agencies, regulators, companies, and governments. Purchasing a sufficiently resilient cloud service (resilience tier), on the other hand, is typically a more short-term goal of an individual organization and does not immediately solve problems in the autonomy tier, such as the future of European jobs, democratic control, or strategic dependencies.

Another added value of our model that we see is that it facilitates a richer discussion around digital sovereignty, going beyond resilience. For example, the different stakeholders and time horizons of each tier will help debunking simplistic views, such as strategic autonomy requiring complete self-sufficiency (autarky), that it would equate protectionism, or that it would fragment the (digital) world. After all, no region or country can provide today's complex digital infrastructures by doing everything themselves, including the EU. However, we do need to have confidence and trust that our partners are not going to undermine our sovereignty.

The Internet and our tiered perspective on digital sovereignty

As for the Internet, we predominantly consider it from the resilience perspective because its capability to connect everyone and everything globally is an essential precondition to enable economic security of societies around the world (and as a result for their digital autonomy). We therefore think that the Internet will remain as a public and global infrastructure for everyone, despite potential risks that regional or national digital sovereignty regimes seek to replace or fragment it. Also, the Internet builds on trusted relations between its 80.000+ constituent networks, which do not undermine each other's sovereignty (in fact, they're called Autonomous Systems in technical speak).

What we do think will be a challenge is what it will take to strengthen sovereignty where legitimate public interests require local variation and control, while preserving the Internet as an open, interoperable network of networks that connects us all (see our previous blogs). For us, this means that the quest for sovereignty must not — and need not — lead to fragmentation of the Internet, that resilience should not be reduced to incident response, and that strategic autonomy should not be confused with isolation.

The better frame is this: justifiable trust in the use of the Internet. That means Internet infrastructure that can be trusted because it is resilient and its integrity, confidentiality and availability cannot get threatened by geopolitization (or for that matter, other international or global phenomena such as climate change). Markets that can be trusted because they retain real choice. Governance that can be trusted because it is transparent, accountable and aligned with public values.

What do you think?

This blog covers work in progress and the result of a Signal discussion, a video call, and a few iterations of this blog. We're curious to hear your thoughts through our LinkedIn post.

---

Three actions to increase digital autonomy at the network layer of the digital stack

Cristian Hesselman, Maarten Botterman, and Paul Timmers | June 21, 2026

At our Internet governance dinner in Utrecht in April, we discussed three topics related to digital autonomy at the network layer of the digital stack: sovereign public procurement of network equipment, a pan-European federation of national Internet emergency backbones, and a future AI-programmable Internet infrastructure. As per the goal of our dinners, we considered them from a governance and a technical perspective. Happy to hear everyone's feedback!

Digital autonomy: justifiable trust in digital systems

We started our discussion by revisiting our view on digital autonomy, the conditio sine qua non of which is justifiable trust in digital systems at all levels of the technology stack, including the global Internet.

We also recognized that it is important that Europe further steps up its game in the space of its local Internet infrastructure because of a rapidly changing risk environment, both from a geopolitical and technology perspective. We discussed three actions we think are needed for that: (1) improve the ability of tendering-obligated European network operators to select European equipment, (2) increase the robustness of the Internet in Europe in situations of heightened tension through a federation of Internet emergency backbones, and (3) prepare for an evolution of the Internet in which AI agents dynamically reprogram Internet protocols and their capabilities in specific networks.

Action #1: strengthen sovereign network procurement

In the short term, we think it's important to strengthen Europe's digital autonomy by enabling tendering-obligated European network operators to set sovereignty requirements for the network equipment they purchase. Examples of such network operators include campus network operators, operators of energy grids, railroad operators, networks of municipalities, and networks for first responders like C2000.

However, setting sovereignty requirements in tenders in a lawful way is currently problematic because organizations often don't know what room for maneuvering they have, for instance to set sovereignty requirements for the procurement of network equipment. The root cause is the complexity of European public procurement regulations and that of the Dutch procurement act. Also, the latter was written in 2012, an era with a different geopolitical dynamic where sovereignty requirements didn't play a role.

The consequence is that network operators may unintendedly end up with equipment from non-EU vendors because price is often the dominant selection criterion when EU and non-EU alternatives are equally suitable. While network operators often manage their network through a closed and high-security management network, they might still consider non-EU equipment a risk because firmware updates can compromise their network, such as through backdoors installed by a nation state in a supply chain attack.

We therefore think that procurement experts need to develop a practical and standardized set of instructions that enable buyers to set sovereignty requirements within the boundaries of current public procurement legislation, which the Dutch Public Procurement Expertise Centre promotes as well. For network equipment, this could involve requirements that vendors keep network management data and services in the EU under European law, use open source and open protocol standards, and adhere to Europe's environmental regulations. At the same time, the European public procurement act needs to be extended with explicit hooks to formulate these kinds of sovereignty requirements, such as through the Sovereignty Effectiveness Assurance Levels.

Of course, this not only applies to network equipment, but also to cloud services, AI systems, chips, and other components of Europe's digital infrastructure, as the Dutch Ministry of Economic Affairs recently outlined. The EU's Proposal for the Cloud and AI Development Act, the Dutch Government's coalition agreement 2026-2030, and the Dutch Data Protection Authority also underscore the need to strengthen sovereign procurement across the stack.

Action #2: set up a federation of Internet emergency backbones

Our second proposed action is to strengthen the robustness of the Internet in Europe for situations of heightened tension, such as a severe national or European crisis or war. For that purpose, we imagine a pan-European federation of Internet emergency backbones, one per member state. Each backbone can temporarily take over the transport of local Internet traffic for critical societal processes and connects to the edge networks of critical service providers and eyeball networks. For example, a Dutch Internet emergency backbone would take over Internet traffic for electronic payment transactions or food supply chain systems in the Netherlands if one or more nation state actors simultaneously disrupt the Netherlands' Internet-facing digital infrastructure using large, coordinated DDoS attacks that regular DDoS mitigation services can't handle anymore, similar to what happened in Estonia in 2007.

A key component of a national general-purpose emergency backbone is the design of its governance model. For example, its decision making structure would determine which organizations can temporarily route their traffic across the backbone under what emergency circumstances. We believe this should be based on multi-stakeholder decision making, involving governments, critical service providers, and citizen representatives. They need to be prepared for their job before a crisis hits, so they need to regularly go through drills, similar to how Dutch organizations carry out DDoS exercises or the research and education sector practices large-scale cyber incidents.

At a technical level, a national emergency Internet backbone could consist of commercial networks, networks that are used for other purposes under normal conditions, dedicated public networks, or a combination thereof. The technical Internet community in the Netherlands attempted to use the concept of an "emergency VLAN" for this purpose back in 2015, but that initiative failed back then.

Action #3: prepare for the "AI-programmable Internet"

Finally, we discussed a more sci-fi-like topic that we came up with, which we call the "AI-programmable Internet". That's a future evolution of the Internet that uses AI agents to self-extend and self-optimize its protocols so it can respond to the changing needs of its users, regulators, and other stakeholders more quickly.

We think the AI-programmable Internet is viable because AI agents have sped up the design, implementation, and testing of software and we speculate it will eventually do the same for network protocol software (perhaps even including formal protocol verification). In addition, we envision that AI agents for network protocols will be able to dynamically deploy the code they generate using programmable networks. For example, researchers are currently experimenting with Large Language Models (LLMs) that generate code in P4, a language that network engineers use to develop and deploy custom data transfer protocols. Device manufacturers such as Intel, AMD, and Cisco offer commercially available P4 products, making the step from research to operations relatively small.

So, if we assume this AI-programmable Internet materializes in the next few decades and evolves "at machine speed", what would that mean for Internet governance? Here are four challenges that we cooked up, but we're sure there are many more.

Shift towards principles: we'll likely need to concentrate even more on governance principles rather than rules because regulation and multi-stakeholder policy design will likely be unable to keep up with the fast pace of AI-generated network protocols. At the same time, governance and technology must align to advance the global Internet and other common goods, from resilience to countering weaponization. We expect a similar change will occur at the technical level because AI agents enable protocol engineers to focus on principles as well, such as the Internet's critical properties and human rights.

Governance design: what kind of governance structures would we need for an AI-programmable Internet? For example, governments and multi-stakeholder Internet bodies such as RIPE or ICANN might need to set up an "AI Advisory Committee" that oversees the guard rails for AI agents that generate protocol code, such as what protocol software their LLMs are trained on and the accountability mechanisms of the organizations that own and run the agents.

Technical design: what would be the impact on the technical design of the Internet? Likely limited if the AI-generated protocols are based on TCP/IP and confine new features or optimizations to specific networks. But what if AI agents also generate and deploy non-TCP/IP stacks, such as the P4-programmable implementation of SCION? One extreme is that it fragments the Internet at the technical level. The other is that the Internet evolves to unify different architectures. The latter will require a new protocol stack-agnostic global routing system or brittle protocol translators at network borders to interconnect networks with different types of stacks. It's a topic that economists and engineers explored in the past and that might regain relevance in the AI-programmable Internet.

Further reinforcement of the IETF: AI agents might further reinforce the IETF's "rough consensus and running code" way of standardizing protocols because they can generate and deploy new protocol software more quickly. Also, the rough consensus part might become easier because the IETF community can evaluate different AI-generated designs or implementations of the same protocol, for instance in terms of performance, security, and scalability. Another potential advantage is that the AI-assisted development of protocol software might reduce the workload on the volunteers in the IETF. Together, this may speed up the standardization of new IETF protocols, which can take years today.

Looking forward to your feedback!

As usual, we'd love to hear your feedback on our discussion, for instance if you see the AI-programable Internet materializing or if you think it's jibber jabber (and why ;-). Feel free to drop us a message through our LinkedIn post.

---

Increasing Europe's digital sovereignty and protecting the global public Internet

Cristian Hesselman, Maarten Botterman, and Paul Timmers | Fri Feb 13, 2026

At our most recent Internet governance dinner in Rotterdam late 2025, we spoke about how to increase Europe's digital sovereignty and at the same time protect the Internet as a global public good, which is a topic we believe received little attention so far. We came up with two suggestions: (1) require designers of governance models for digital sovereignty to explicitly consider and mitigate the risks that their designs might pose to the Internet, and (2) further advance Europe's digital sovereignty by using these "Internet-friendly" governance models for alliances of like-minded stakeholders, such as sectors of society and groups of network operators. We also suggest using these models in other layers of the Eurostack through what we call a "Governance Plane". Our thoughts on these topics are still baking, so happy to hear everyone's feedback!

Digital sovereignty and side-effects on the Internet

Our discussion started with a short reflection on the history of digital sovereignty discussions in Europe, which started around 2015, in academia, at the EU in Brussels, and in industry in Germany. Around 5 years later it got traction in the Netherlands, for instance in the media and in research. The war in Ukraine and Trump's second presidency further pushed the conversation into the mainstream, with it now being widely acknowledged as an important societal problem in the Netherlands and around Europe. For example, the new Dutch government explicitly flags it in their coalition agreement 2026-2030.

While we strongly support increasing Europe's digital sovereignty, we also observed that governance models to improve digital sovereignty can haven unintended side-effects for the Internet. An example is how the Italian government enforces its copyright regulation on the Internet in Italy, which we consider a form of digital sovereignty. Their governance model is based on an automated system called the Piracy Shield, which instructs the DNS resolvers of ISPs and VPN providers in Italy to block domain names that have been flagged as distributing pirated content (which they are obliged to do). The risk of this approach is that it can result in overblocking, which is what happed in October of 2024: the Piracy Shield caused Google Drive to become unavailable across Italy for several hours because the Italian telecom regulator accidentally put the domain name drive.usercontent.google.com on the shield's blocklist. In our opinion, the oversight was that the DNS is part of the Internet's core and bears the risk of affecting many users when used carelessly. In addition, they did not include a verification step or a roll-back mechanism.

Another example is a recent Chinese proposal in the ITU to manage the Domain Name System (DNS) using a blockchain variant with centralized control, thus instilling a Chinese form of digital sovereignty onto the Internet and doing away with the Internet's global, open, and multistakeholder model. (Fortunately, the proposal did not get endorsed and the UN General Assembly, which instead reinforced the global, open, and multistakeholder approach.) A similar example is "New IP", a Chinese proposal for a new Internet design from 2020. It was dismissed because it conflicted with human rights, for instance because it had built-in capabilities for a surveillance-based governance model.

These two examples illustrate that governance models for digital sovereignty need to be designed carefully to avoid impacting the Internet's operation and, ultimately, citizens' and businesses' trust in the Internet as a global communications platform.

Governance models for digital sovereignty

To aid such a careful design, we distinguish three roles in governance models for digital sovereignty, as shown in Figure 1: the ecosystem being governed, a decision structure, and enforcements points. The last two roles are inspired by the concepts of a decision point and an enforcement point in policy-based computer networking.

Governed ecosystem: a group of interdepend organizations or individuals that are the primary subject of digital sovereignty-related decisions. In the example of the Piracy Shield, the governed ecosystem encompasses Internet users in Italy. This form of governance is commonly called governance on the Internet, which is usually about topics such as copyright, free speech, and cybercrime. The counterpart is governance of the Internet, which is when the governed ecosystem is part of the Internet itself. An example is the ecosystem of DNS operators in Europe, to which the European Commission added the public resolver "DNS4EU" to increase the EU's digital sovereignty in the DNS space.

Decision structure: makes digital sovereignty-related decisions (arrow 1 in Figure 1) and defines decision making roles, rights, and accountability and transparency mechanisms for that purpose. An example of a digital sovereignty-related decision is putting domain names on a block list in the example of the Piracy Shield or creating DNS4EU for citizens and businesses in Europe. In the Piracy Shield, the decision structure consists of an external national authority (Italy's telecom regulator) that makes decisions top-down. The decision structure can also be bottom-up and community-led, such as at ICANN. For governance on the Internet, decision structures often involve national or regional governments, whereas governance of the Internet usually involves multi-stakeholder organizations such as ICANN and RIPE. The input for the decision structure is data about the ecosystem's digital sovereignty level (arrow 2) and it needs to be transparent about its decisions and accountable to the governed ecosystem (arrow 3). For example, the Piracy Shield could publish reports from the ISPs indicating how many DNS requests they blocked over time.

Enforcement points: places in the ecosystem where humans or automated systems take actions that implement digital sovereignty-related decisions coming out of the decision structure. The actual blocking of DNS traffic for a domain name on the Piracy Shield's blocklist by ISPs on their DNS resolvers in an example of automated enforcement.

Suggestion #1: assess and mitigate the risks that digital sovereignty governance may pose to the global Internet

Our first suggestion is that designers of governance models for digital sovereignty explicitly include (1) a technical assessment of the risks that their design might pose to the operation, security, robustness, and openness of the Internet and (2) define measures to mitigate these risks. This is particulate important if the governance model oversees an ecosystem on the Internet but its design uses enforcement points in the Internet (see Figure 1). For example, the designers of the Piracy Shield's governance model should have assessed the risk of overblocking and should have defined mitigations, such as validating that a domain name is indeed serving pirated content or being able to quickly remove a domain name from the Shield's blocklist again. In general, we believe designers should enforce sovereignty decisions like this on the Internet and not in it.

Similarly, we also suggest that designers of governance models for infrastructure in the Internet carry out these risk assessments. For example, public DNS resolvers like DNS4EU can gradually move DNS traffic away from DNS resolvers at ISPs, which traditionally handle DNS traffic in a decentralized way to increase the DNS' overall resilience. The risk is that this shift contributes to the further centralization of the DNS and reduces its resilience because popular DNS resolvers become choke points.

Risk assessments require close collaboration between governance and technical experts, as we argued in our previous blog. For example, the technical risk analysis could be a collaboration between policy makers who want to prevent users from pirating content and technical experts who understand the risks of blocking domain names through the DNS. Alternatively, the analysis can be based on empirical data, such as on the effectiveness of blocking Russian media outlets in the EU.

Suggestion #2a: digital sovereignty through sector-specific governance models

Our second suggestion is to use the above "Internet-friendly" governance models to improve the digital sovereignty of alliances of like-minded stakeholders (the governed ecosystem in Figure 1). One example are sector-specific governance models. We consider them promising because sectors have a shared language and common interests, which allow them to jointly set digital sovereignty goals and monitor and enforce them. A sector can also share the investments required to increase their digital sovereignty, anticipate and counter geopolitically motivated captures, and enable accountability mechanisms that fit the sector's culture.

Our vision is that such a sectoral governance model is based on a "observatory" that creates a digital sovereignty index for the sector, for instance by regularly measuring which organizations in the sector use which cloud providers (arrow 2 in Figure 1). The members can use this index to discuss and decide on measures that organizations need to take to improve the sector's digital sovereignty (arrow 1), such as best practices to increase the portability of software across cloud platforms, the use of opensource software, or off-cloud signing mechanisms to protect the integrity of the data stored in the cloud. The observatory could be the sector's Information Sharing and Analysis Center, Computer Emergency Response Team, or a third party.

In the Netherlands, the education and research sector uses a governance model like that in which they tasked their National Research and Education Network (arrow 1) to help them increase their digital sovereignty, for instance through a joint pilot with an alternative cloud operator, the development of an AI factory, and by moving equipment to their members' data centers. Another example is the Netherlands' Anti-DDoS Coalition, an initiative for the critical services sector to jointly fight large DDoS attacks. Their governance model decides on the admittance of new members, which can then push and pull fingerprint of DDoS attacks from a database operated by the Coalition, thus helping them to better control how they handle DDoS attacks.

Suggestion #2b: digital sovereignty through network operator-based governance models

Another type of alliance we envision are groups of network operators (the governed ecosystem in Figure 1) that jointly wish to provide network-level assurances beyond basic IP connectivity. We refer to such groups as "trust zones", a term coined by Internet pioneers David Clark and kc Claffy. In our vision, trust zones are "pockets" of additional trust in the Internet, while their networks continue to be fully connected to the Internet (so no Internet fragmentation). Our notion of a trust zone is broader than the original, which focuses on a specific routing security mechanism (BGPsec).

Network operators in a trust zone can improve their digital sovereignty through many kinds of assurances. For example, they could jointly validate the security of the routers they purchase, such as by checking their software for backdoors, formally verifying that routers behave the way they should, or by avoiding equipment they don't trust. Another example is that the members of a trust zone share security data with each other, such as on DDoS attacks or incidents in networks in the research and education sector. They can also formulate requirements on the joint use of security services and technology, such as that all members need to use DDoS scrubbing services to protect their networks, jointly protect against origin and path hijacks by collectively deploying technologies such as ASPA, or that everyone implements router attestation. Trust zones could even jointly help maturing emerging network security technologies, such as BPGsec.

A real-world example that we consider an early form of a trust zone is MANRS (short for Mutual Agreed Norms for Routing Security), which has over 1,200 participating networks globally with a network operator-led decision structure. It defines various routing security measures that members need to take, such as filtering of potentially malicious routing messages. Another example of a trust zone are National Research and Education Networks, which provide trusted network, security, and identity services local universities and other institutes across the country.

Governance models across the technology stack

Our final discussion was on generalizing our notion of "Internet-friendly" and alliance-based governance models for digital sovereignty to other layers of the technology stack. This is where we came up with the Governance Plane (GP), an abstract space in which governments, technical experts, infrastructure operators, and other stakeholders together negotiate, design, and evolve these governance models for specific layers of the Eurostack, for digital sovereignty or other purposes. The global public Internet sits at the Eurostack's Networks layer (Figure 2).

The GP gives governance models an explicit position in the stack, with their transparency and accountability mechanisms (arrow 3 in Figure 1) enabling justifiable trust in our digital infrastructure. For example, the large language model for Dutch (AI layer) has its own governance model, which aims to improve Europe's position in the space of AI and transparently report on the data the model is being trained with, amongst others. Another example are sectoral governance models (see Suggestion 2a) such as the .bank top-level domain (networks layer), which adds the stricter security and assurance requirements of the banking sector directly onto the global Internet, giving them more control over their domain name space. Radio spectrum management for mobile networks (bottom layer) is typically regional or national. Similarly, special-purpose networks such as time and frequency networks (networks layer) require different types of governance models, such as in the context of research and education.

Examples of global Internet governance models are those for the Domain Name System (DNS), the Internet's routing system, and the WebPKI (networks layer). Multi-stakeholder communities at ICANN (DNS), RIPE (routing), and the CA/B Forum (WebPKI) design, implement, and evolve these models, focusing on safeguarding and enhancing the openness, security, and stability of the global Internet.

Our inspiration for the GP is David Clark's 2003 concept of a Knowledge Plane (KP), a technical cross-layer construct that observes, reasons, and assists network operators in managing the Internet. Our GP is different in that it is more about the governance of that operation and operates at a "slower" timescale than the KP.

Vision: structured descriptions of governance models

From a technical perspective, we imagine that the GP describes governance models through publicly available documents that follow a to be developed standardized structure, for instance based on Figure 1. They would not only include the risks and mitigations to protect the global Internet, but also the model's overall design, for instance in terms of decision-making roles, decision and data collection processes, and accountability mechanisms. An example is RSSAC037, which discusses the governance model of the DNS' root server system (though not in a standardized structure).

Ultimately, we think these descriptions could be part of a governance model database that enables stakeholders from the same or different layers to learn from each other. The database will further add to justifiable trust in our digital infrastructure because it will allow designers to reuse (parts of) governance models that have proven to work and avoid ones that didn't. This is like the KP but applied to the design of governance models.

Sovereignty through architectural restraint

Our conclusion from our discussion in Rotterdam is that digital sovereignty requires what we call "architectural restraint": design governance models for digital sovereignty in a way that protects the global Internet and place governance where it can do the most good and the least harm. It does not require breaking the Internet, nor does it require naive faith in global cooperation.

The GP with its "Internet-friendly" and alliance-based governance models may be a good way forward to help to increase Europe's digital sovereignty and at the same time preserve the Internet as a global public good - one in which people can have not blind trust, but justifiable trust on which a wide range of new digital services will thrive.

Looking forward to your feedback!

We'd love to hear your feedback if you think it would be worthwhile to further flesh out our suggestions (or not). Feel free to drop us a message through our LinkedIn post.

---

Three suggestions to improve the interaction between Internet governance experts and Internet technologists

Paul Timmers, Maarten Botterman, and Cristian Hesselman | Thu Sep 4, 2025

We propose three actions to improve the interaction between Internet governance and Internet technology experts, which we think is key for a secure, robust, and open Internet, the autonomy of regional and national infrastructures that run on top of it, and a strong multi-stakeholder model for Internet governance, operation, and standardization. Here's the expanded version of what we came up with over dinner in sunny Antwerp back in July.

Problem: policy and technical experts understand each other only superficially

The problem that we discussed is that today's governance and technical experts typically only superficially understand each other's worlds, which was a key observation that also came out of the 2025 NLIGF workshop "Building bridges between policy and technology in Internet governance" and the Marconi Society's 2024 workshop on Internet resiliency.

As a result, policymakers frequently lack basic knowledge of the Internet's core technical systems, standards, and terminology, which might lead to policies that are limited in attaining their intended goal or that may even cause collateral damage. Similarly, technical experts often concentrate on the features and costs of systems such as cloud services and less on geopolitical and societal considerations, although this is changing. Internet technologists also seem to undervalue the interaction with Internet policymakers, as indicated by only 15% of the 2025 Global IGF's attendees being from the technical community, which we think this is a low number for discussions on complex technology with a global and increasing impact on almost everything we do.

We believe bridging the governance-technology divide is essential because Internet governance more and more runs through the different layers of the technology stack, thus affecting both the global Internet and regional and national infrastructures that run on top of it, as we argued earlier. We identify three actions that could help solving the problem.

Action #1: enable the next generation to combine Internet governance and technology

The first action we suggest is to extend university teaching programs so that the next generation of Internet policymakers and engineers get to understand each other better right off the bat and also get to see the need for such mutual understanding, as was also discussed at the NLIGF. We believe this is a critical global priority, as today's students will inherit both the opportunities and the challenges of a rapidly evolving digital society. By integrating Internet policy and technology in university education, we cultivate an informed, diverse, and inclusive new generation of Internet stewards capable of balancing global and local perspectives, innovation, openness, and security in the digital age.

One way to accomplish such integration might be for universities of technology to extend their courses on Internet protocols and Internet measurements for (under)grad students with material on Internet governance, such as in terms of the ecosystem of governance bodies, real-world national and regional policy use cases, and policy development processes at organizations such as ICANN and governments. Similarly, business schools and management science studies could extend their programs with tutorial-style backgrounds on how routing security works and what risks Internet communication entails if security mechanisms aren't widely deployed. Visualizations and installations showing how the Internet works might also help.

An important challenge to develop courses that combine Internet policy and technology is to develop a language to explain concepts from the policy world to technical students and the other way around. For example, an Internet routing teacher might need to draw a parallel with taking a wrong exit on a freeway to explain how BGP security works to policy-focused students or might refer to an ornithology to convey the potential public policy aspects of ongoing work in the IETF.

Another challenge is to attract students, for instance by incorporating inspiring real-world use cases that mix Internet policy and technology courses. One example use case that was discussed at the NLIGF is the RIPE NCC's decision to remain neutral in the war that Russia initiated with Ukraine because they believed "the means to communicate should not be affected by domestic political disputes, international conflicts or war". We reckon it would be highly interesting for students if someone from the RIPE NCC could expand on the policy considerations in the context of their technical role.

Fortunately, the academic community can draw inspiration from ICANN, regional Internet governance forums, the Internet Society, and others. These Internet organizations foster youth engagement by combining technical training with policy dialogue, ensuring that the next generation of leaders not only understand how the Internet functions—through standards, protocols, and infrastructure—but also how governance decisions on issues like cybersecurity, data protection, and digital rights shape the Internet's future and how they can contribute to multistakeholder processes. Example programs are the National and Regional Youth IGF Initiatives, NextGen@ICANN, and regional Schools on Internet Governance.

Action #2: bring governance and technology experts together around specific challenges

The second action we propose is to bring policy and technology experts together to solve specific Internet challenges, both global and regional. It will also help experts from both sides to better understand each other's thinking, but on the job instead of in school (see Action #1).

One example where both disciplines are crucial is the concept of what we call a "Digital Autonomy indeX" (DAX), which provides macro-level insight into the level of digital autonomy of a region, nation, or sector based on real-world Internet measurements. We think such an index is important because it will enable policymakers to design, evaluate, and refine policies related to strategic digital autonomy in a more data-driven way. For example, European policymakers could use the index to evaluate to what extent DNS4EU achieves its goal of increasing Europe's level of autonomy in the space of public DNS resolvers by adding measurements such as those of APNIC to an EU-level DAX. Ultimately, it could be an extension of the EU's Digital Economy and Society Index that covers the different technology layers of the vision, going up as high as AI and as low as raw materials. Nextcloud's recent initiative provides a visual intuition of how we see a DAX, although their measurements are still rudimentary.

The collaboration between the two disciplines lies in the policy community focusing on DAX attributes and engineers finding methods to measure them. For example, engineers could map DAX attributes on Internet centralization to methods that measure the share of DNS requests coming from or that analyze the MX records of organizations' domain names. Similarly, they could map attributes on interoperability to measurements of the uptake of open Internet standards. Technical experts can also help setting up sector-specific DAXes, for instance by measuring DNS attributes of member organizations' domain names and asses to what extent they use hyperscalers for their Internet-facing services. Policy makers can use these values to increase autonomy in the sector, for instance by providing members with best-practices on cloud operator-agnostic software development or running their infrastructure in a hybrid way.

Another concrete Internet challenge is DNS blocking, a technical mechanism that policymakers at various levels (regional, national, organization) widely use to block or modify access to sites, for instance because they consider these sites illegal or because they may be spreading malware. While blocking is conceptually simple, it is also highly controversial because it may have side effects, such as reducing the availability of other sites beyond the scope of the block. Also, blocking on DNS resolvers may only be partially effective, as the example of the EU's policy to block Russian media outlets illustrates. These effects are well-known in the technical community and policymakers can benefit from early discussions with them to better understand the impact of DNS blocking, for instance in terms of proportionality and subsidiarity. This expertise is also relevant for national public DNS resolvers with a public-private governance model, which complement the model of privately governed global resolvers such as Google's.

A third issue is cross-sectoral dependencies, such as the mutual dependency between energy and communication networks in emerging decentralized energy grids. They involve a complex interplay between prevention (often underfunded and diffuse), technical architecture, governance frameworks, and strategic alliances that are necessary for a truly resilient Internet, as recently discussed at the Marconi Society's Internet Resilience Institute.

Action #3: don't forget to invest in the global Internet

Our final call to action is that policy makers and technical experts don't forget to reinforce the openness, security, and robustness of the global Internet. This is important because there has (rightfully) been a lot of discussion on strategic digital autonomy in regions such as Europe and countries like the Netherlands and Brazil, but digital infrastructures across the globe are ultimately the product of global, regional, and national Internet policies and systems, as we argued previously. So, we must invest in all three levels at the same time, including the global Internet.

One way to accomplish that is for regions, countries, and organizations to continue to allocate time and resources to contribute to global Internet policy organizations like ICANN and technical bodies such as the IETF. This allows the global Internet to continue to function for everyone, while respecting regional and national policy variations depending on culture, legislation and current state of technology implementation in networks.

Let us know your thoughts!

As before, we're happy to hear your feedback on our proposals, so feel free to drop us a message through our LinkedIn post.

---

Three observations on the Internet in a multipolar world

Cristian Hesselman, Maarten Botterman, and Paul Timmers | Sat Feb 15, 2025

We offer three observations on the Internet in a polarizing world, which we discussed over dinner in the old town of Utrecht, the Netherlands, on January 30. Like back in October, we leveraged Paul’s and Maarten’s Internet governance expertise and my technical knowhow, which again led to a very interesting and lively debate.

Observation #1: multi-stakeholder Internet governance is more important than ever in a multipolar world

With the return of geopolitical blocs, we believe a multi-stakeholder community that standardizes, governs, and runs the public core of the Internet is more important than ever. This is because a state-dominated governance model in a multipolar world would introduce the risk of bringing inter-bloc or inter-state rivalry and conflict into global Internet policy making, which likely would result in certain people, organizations, or countries being banned from the Internet, thus diminishing its value as a global communications network. As a result, the Internet might even further fragment along geopolitical “fault lines“ for decades, which would hinder the rise of a future world order with fewer geopolitical tensions.

We believe the Internet’s current multi-stakeholder governance model with businesses, individuals, civil society, technical communities, and governments from around the globe reduces the risk of further global Internet fragmentation because it provides a pragmatic way forward beyond national interests and geopolitical agendas. This strengthens a “neutral“ form of Internet governance that focuses on keeping the Internet a global public communications infrastructure that is secure, stable, and open, allowing all individuals, organizations, and countries to connect to it and use it as a trusted instrument to address their problems and seize opportunities. For example, institutions like the IGF, ICANN, the IETF, and the RIRs treat all nations and economies based on the same established and published transparent principles for all.

In other words, we think global multi-stakeholder governance has proven to be a model that aligns with the Internet’s role as a worldwide civil communications infrastructure that needs to serve everyone across generations and across geopolitical landscapes.

Observation #2: in a multipolar world, the global multi-stakeholder model will co-exist with various regional and national Internet governance models

Our second observation is that in a multipolar world, the global multi-stakeholder model will co-exist with various continually evolving regional and national Internet governance models. Depending on the region’s societal system, these models will bring values and norms into the Internet protocol stack in various degrees. For example, the political system in Russia turned the Internet in Russia (RUnet) from an open infrastructure in the 2000s to a tightly state-controlled system as of the early 2010s with extensive surveillance and censored connections to the global Internet. Towards the other end of the spectrum, Europe emphasizes “good behavior“ and actively supports a global and open Internet, yet requires as an exception ISPs to block certain Russian media outlets since the war in Ukraine in 2022.

These regional policies also play a role at the protocol level, for instance in regions that actively promote the adoption of global IETF standards to increase Internet security and privacy for their citizens. For example, the US government recently urged network operators to implement security standards help avoiding the illegal interception of Internet routes, while in Brazil and in the Netherlands public-private partnerships stimulate the uptake of secure and privacy-enhancing DNS and email standards and good practices. Regions might further evolve this kind of thinking in the future by stimulating or even requiring networks to share data on their carbon emission to make the Internet more CO2-neutral.

So, regional politics is at all layers of the protocol stack though in various region-specific ways. It’s no longer the “politics-free“ stack of the early days (see Figure 1) because the Internet continues to further integrate into societies globally. As a result, it is increasingly important that “the technical architecture must accommodate the tussles of society while continuing to achieve its traditional goals of scalability, reliability, and evolvability“, as Internet pioneer David Clark put it back in 2005.

Observation #3: the increasingly polarizing approach to international relations is another call for Europe to strengthen its digital autonomy

Next to issues like privacy and intellectual property protection regimes that have been developing over decades, we see that the current uncertainties in the space of international relations lead to a further call for Europe to strengthen its digital autonomy and create a trusted environment for European data. However, this requires member states to collaborate more, as researchers from the Clingendael Institute recently pointed out. As a result, member states might feel more comfortable putting (parts of) their critical and privacy sensitive data and compute on cloud infrastructures in other EU member states rather than in clouds headquartered outside of the EU jurisdiction (currently mostly in the US).

We also observe various possibilities to further safeguard trust in the Internet within the EU region. For example, the EU could opt for a market strategy through which they protect new successful European cloud initiatives so they can grow without global hyperscalers preemptively buying them. Another possibility is that customers of global cloud providers team up and jointly state that they’ll switch to an EU provider if its capabilities match those of today’s dominant hyperscalers headquartered outside of the EU. This might make it easier for EU cloud providers to invest in innovating their service offerings because they know they’ll have customers waiting for it. From a technical perspective, cloud users could employ various forms of hybrid cloud architectures. For example, they could use a global provider as their primary and an EU provider as their backup, so they can easily switch them around once the latter is on par with the former.

While we understand the rationale and support the development of European alternatives to today’s hyperscalers, we think it is important to avoid the creation of closed cloud offerings if these would stifle innovation in the European cloud market and hamper adoption by countries outside the EU. To facilitate that, the EC could actively promote open designs and open source for new cloud services, enabling people around the world to more easily start a new cloud business and reduce the risk of further centralization of the global Internet around a handful of very large players. The open design of the DDoS Clearing House (open source software, and open legal and organizational templates) might offer a first glimpse of how to accomplish this.

Happy to hear what everyone thinks!

We’re happy to hear your feedback on our observations, so feel free to drop us a message through our LinkedIn post.