The global IT outage in July 2024 caused critical infrastructure disruption. While some advocate for digital sovereignty to reduce dependency on external technology providers, Aleksei Turobov argues that collaboration offers a more effective response to complex challenges. He highlights how the collective effort and resource mobilisation during the crisis demonstrated the benefits of a globally integrated framework over isolationist approaches in digital governance.
On the morning of 19 July 2024, a massive IT outage unfolded when CrowdStrike, a leading cybersecurity firm, released a faulty update of its ‘Falcon Sensor’ security software. This unintentionally broke over 8.5 million Windows OS devices worldwide. The malfunction disrupted critical infrastructure across several sectors, including:
- Financial Institutions: over a dozen banks and financial services, including VISA, experienced operational challenges (Mashable).
- Airports: the disruption led to the cancellation of over 4,000 flights and delayed 35,500 more on a global scale (Wired).
- Services: hospitals, emergency services (BBC), and TV broadcasts (NewcastStudio) faced significant operational challenges.
One reaction in the aftermath of the outage was to emphasise digital sovereignty. The incident is used by some commentators to underscore the risks of dependence on external technology providers, particularly for European companies and institutions, in the face of potential service disruptions and cyber threats (Ruetir). The advocated alternative is a model of technological autonomy akin to China’s approach, which is seen as a way to enhance security and stability in mitigating geopolitical tensions and cyber vulnerabilities (CloudTech). Voices in countries like Turkey (Turkey Today) and Qatar (Gulf Times) have called for governments to prioritise domestic software development to safeguard their digital infrastructure and national security. Similarly, the movement towards data sovereignty, with over 70% of countries having in place some data sovereignty legislation, according to Unctad (IBM).
But there is an alternative perspective, advocating for a balanced approach that values collaboration over international fragmentation, and emphasising that a globally integrated framework may offer greater resilience and innovation potential.
Why might this be a better approach? While concerns naturally arise regarding the absence of fail-safe mechanisms, recovery systems for critical infrastructure, and the potential risks of relying on a single overseas-based vendor, the recent outage underscores the vital importance of collaboration over autonomy. The incident highlights that a shift towards collective action and resource mobilisation may be a more effective strategy in addressing complex, time-sensitive challenges. Fostering collaboration across company boundaries throughout the supply chain can significantly minimise risks (Forbes). Such a collaborative approach is supported by studies showing that collective actions can effectively manage and mitigate risks across multiple domains in cybersecurity (Gillard et al., 2023).
When the Crowdstrike crisis struck, the rapid mobilisation of resources showcased how various stakeholders contributed to recovery efforts (Kroll). Notably, Microsoft even opened up communication with cloud competitors like Amazon and Google (TheVerge) to mobilise resources and develop an optimal solution. CrowdStrike and Microsoft conducted joint investigations, coordinated support, and maintained open lines of communication (Sprints), demonstrating a commitment to industry-wide cooperation rather than fostering a culture of blame (TheVerge). This incident underscores that “…we learn, recover and move forward most effectively when we collaborate and work together” (Microsoft). Such a collaborative approach allowed organisations and governments to address the crisis more swiftly and efficiently than they could have done by themselves or in a ‘sovereign’ context. Pursuing a path of autonomy and digital sovereignty, with limited resources and reduced potential for collective action, presents a riskier path.
Despite the advantages of collaboration and globalisation in technological innovation, knowledge transfer, resource availability, human capital development, and trade in digital goods and services, digital sovereignty remains appealing, particularly when faced with real threats to national security. The importance of security amidst geopolitical uncertainties and instability is compelling nations to consider strategies prioritising national control over critical digital infrastructure.
However, the path to achieving digital sovereignty is fraught with complexities. Data from the OECD’s Digital Services Trade Restrictiveness Index highlights the pervasive nature of digital restrictions within domestic markets (Fig. 1) across 90 countries from 2014 to 2023, which reveals the evolving landscape of digital barriers. Each bar represents the total index value for a country, segmented by year to illustrate annual variations. Colours denote different years, visually representing shifts in digital service restrictions. Even such a simplified approach to visualisation demonstrates that digital restrictions, while aimed at enhancing security, have significantly shaped and loaded the technological landscape over the past decade.
Fig.1 This histogram displays the aggregated Restrictiveness Index values for digitally enabled services across 90 countries from 2014 to 2023. Each bar represents the total index value for a country, segmented by year to illustrate annual variations. Colours denote different years, visually representing trends and shifts in digital service restrictions. Computation author’s own using Python.
As countries seek to reinforce the narrative of digital sovereignty, they must grapple with the economic implications of such a stance. Restrictive measures, like data trade barriers, can stifle technological innovation, slow development and negatively affect the economy (Gupta et al., 2022). Moreover, the interconnectedness of domestic and international digital ecosystems means that unilateral moves towards digital autonomy can have far-reaching consequences. Implementing strict digital sovereignty policies could result in a fragmented digital economy, where isolationist policies constrain the potential for growth and innovation.
The challenge lies in protecting national interests while fostering an open, collaborative environment. The CrowdStrike incident serves as a case study illustrating the possibilities of a more integrated, collaborative framework in digital governance. The response shows the benefits of leveraging the power of collective action and resource mobilisation to build resilience and ensure the stability of critical infrastructure. For the reality is that domestic and international institutions may not always be equipped to manage effectively a world with a growing number of digital restrictions. The future of digital governance depends on our ability to strike this balance, ensuring that the understandable pursuit of digital sovereignty does not come at the cost of technological advancement and global connectivity.
Image: BSOD at Dulles Airport due to the botched CrowdStrike security update on July 19, 2024, by Reivax. Licensed under the Creative Commons Attribution-Share Alike 2.0 Generic licence.
The views and opinions expressed in this post are those of the author(s) and not necessarily those of the Bennett Institute for Public Policy.
