Thin sovereignty, thick autonomy

Yet Europe’s response to these cybersecurity challenges is increasingly entangled with a broader project of digital sovereignty, driven by valid concerns about American and Chinese technological dominance, alarm over foreign interference and online harms, and a desire to assert regulatory authority and strategic autonomy. The resulting political impulse often equates security with control: treating the protection of European societies as synonymous with controlling digital infrastructure, excluding or restricting non-European providers, and reasserting state authority over digital spaces. But this can misdiagnose what cybersecurity requires: resilience, options, and cooperation among European and non-European partners.

Some degree of digital sovereignty is essential for law enforcement, national security, and constitutional legitimacy. But digital sovereignty is neither achievable nor desirable for Europe at scale, and it does not, in itself, reliably support Europe’s cybersecurity interests, which are rooted in the resilience and continued functioning of digitally dependent societies. An overemphasis on sovereign control risks fragmentation, inefficiency, and strategic self-constraint, resulting in greater vulnerability. Therefore, Europe should pursue a design that keeps sovereignty thin and targeted while building thick autonomy to position it to deal effectively with persistent digital stress.