Technology, Cyber Power and Digital Geopolitics

Introduction

Digital technologies have become instruments of international power. States compete not only through military forces and trade, but also through control of data, semiconductor supply chains, telecommunications networks, cloud infrastructure, digital platforms, artificial intelligence (AI), satellites and cyber capabilities. For international businesses, this competition creates both opportunities and risks: a software service may be prohibited by sanctions, a factory may be disrupted by ransomware, a cloud provider may become subject to foreign access laws, or an export control may prevent access to advanced chips.

Digital geopolitics concerns the interaction between technology, political authority, economic interests and international security. It asks who controls critical infrastructures, whose rules govern digital activity, where data is stored, which firms provide essential services, and how technological dependence can be converted into influence. The central lesson is that technology is not politically neutral. Technical standards, ownership structures, supply chains and regulatory choices distribute power.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain cyber power, digital sovereignty and platform power.
2. Distinguish cybercrime, cyber espionage, cyber sabotage and cyberwarfare.
3. Analyse the geopolitical importance of semiconductors, telecommunications, data and AI.
4. Evaluate how surveillance, autonomous systems and space infrastructure affect international relations.
5. Assess digital risks for international firms and propose governance and resilience measures.
6. Apply a geopolitical risk framework to a technology-dependent business.

1. From Geopolitics to Digital Geopolitics

Classical geopolitics examined how geography, resources, sea routes and territorial position shaped power. Digital geopolitics extends this analysis to infrastructures that are partly physical and partly virtual. Data centres, undersea cables, satellite constellations, internet exchange points, semiconductor fabs and cloud platforms all have geographical locations and political owners, even when the services they support appear borderless.

Three features distinguish digital power.

First, dependence is often concealed. A firm may have customers in twenty countries while relying on one cloud provider, one software library, one chip designer or one cable route. A disruption at a single point can therefore produce international consequences.

Second, dual use is widespread. The same technologies can support commerce and military operations. Satellite navigation supports logistics, agriculture and precision weapons. AI can improve medical diagnosis, detect fraud or generate disinformation. Encryption protects consumers but can also obstruct investigations.

Third, power is distributed among states and firms. Governments possess legal authority, intelligence capabilities and coercive instruments. Firms control platforms, intellectual property, standards, infrastructure and technical expertise. Their relationship is cooperative in some areas and adversarial in others.

A useful analytical distinction is between three layers of digital power:

Power at one layer can reinforce power at another. A company with a dominant cloud platform may collect data, shape technical standards and gain political bargaining power. A state that controls a key semiconductor technology can use export restrictions to influence other states.

2. Cyber Power and Cyber Conflict

Cyber power is the capacity to achieve political, economic or security objectives through the creation, control or disruption of digital information and networked systems. It includes offensive capabilities, defensive capabilities, intelligence collection, technological dependence and the ability to shape norms and standards.

Cyber operations are commonly classified as follows:

• Cybercrime: unlawful activity for financial or personal gain, such as ransomware, payment fraud or identity theft.
• Cyber espionage: covert acquisition of information, often for intelligence or commercial advantage.
• Cyber sabotage: deliberate disruption or destruction of systems, such as disabling industrial control systems.
• Cyber influence operations: manipulation of information environments through disinformation, fake accounts or targeted propaganda.
• Cyberwarfare: politically directed cyber operations associated with armed conflict. The term is contested because many operations occur below the threshold of war.

Attribution is a central problem. Digital attackers can use compromised servers, false flags, criminal groups or proxy organisations. Technical evidence may identify the infrastructure used in an attack, but not necessarily the person or government that ordered it. Consequently, states often combine forensic evidence with intelligence, behavioural patterns and political assessment.

Cyber conflict is frequently described as asymmetric. A relatively small actor can impose costs on a larger state or corporation because digital tools are inexpensive compared with conventional military systems. Yet asymmetry should not be exaggerated. Effective operations require access, expertise, intelligence, persistence and an understanding of the target’s processes. Defensive maturity, segmentation, backups and rapid recovery can substantially reduce an attacker’s advantage.

A practical risk model represents expected cyber loss as:

Here, E(L) is expected loss in monetary units, P(A) is the probability of an adverse event during a defined period, and I(A) is the estimated impact if it occurs. The model assumes that probability and impact can be estimated consistently. It is a decision aid, not a prediction: cyber events may be correlated, probabilities may be uncertain, and reputational or political effects may be difficult to monetise.

For example, if a firm estimates a 6% annual probability of a major outage and an impact of $4 million, expected annual loss is:

E(L) = 0.06 × 4,000,000 = 240,000

The result does not mean that the firm will lose exactly $240,000. It supports comparison of controls. A $100,000 resilience investment may be rational if it materially reduces the probability or impact of the event, although strategic and legal considerations must also be included.

3. Digital Sovereignty and Data Governance

Digital sovereignty is the capacity of a state, organisation or community to control decisions about its digital infrastructures, data, technologies and rules. It does not necessarily mean complete technological self-sufficiency. In practice, sovereignty usually means reducing unacceptable dependence and retaining the ability to make independent choices.

States pursue digital sovereignty through:

• data-protection and localisation requirements;
• domestic cloud and cybersecurity standards;
• public procurement rules;
• local semiconductor, telecommunications and AI programmes;
• restrictions on foreign platforms;
• national digital identity and payment systems; and
• control over critical infrastructure.

Data governance concerns who may collect, access, transfer, analyse and delete data. It includes privacy, cybersecurity, intellectual property, competition, records management and cross-border transfer rules. These areas can conflict. A government may seek data localisation for security, while a multinational firm may need centralised data processing for efficiency.

The main governance models are not perfectly separate, but three broad approaches are useful:

1. Market-led governance emphasises innovation, voluntary standards and private-sector responsibility.
2. Rights-centred governance prioritises privacy, due process, transparency and individual control.
3. State-centric governance prioritises national security, social stability and governmental access.

International firms must identify which rules apply to each data category and jurisdiction. A compliance programme should map data flows, classify sensitivity, evaluate transfer mechanisms, restrict access by role, maintain audit trails and prepare breach-notification procedures. Data sovereignty is therefore both a political question and an operational design question.

4. Platform Power and the Political Economy of Digital Markets

Digital platforms connect different groups, such as users and advertisers, drivers and passengers, sellers and buyers, or developers and consumers. Their power frequently grows through network effects: a service becomes more valuable as more participants use it. Platforms may also benefit from data accumulation, economies of scale, switching costs and control over access to customers.

Platform power has geopolitical consequences. Large firms can influence public discourse, determine which applications are available, impose technical rules on businesses and respond to government requests. Their content moderation, payment policies and algorithmic ranking can affect elections, social movements and international reputation.

Platform governance raises several questions:

• Is a platform a neutral intermediary or an editor?
• How should competition law address self-preferencing and acquisitions of potential rivals?
• What process should users receive when content or accounts are removed?
• How should platforms respond to state censorship and foreign influence operations?
• Who is responsible when algorithmic decisions cause discrimination or economic harm?

Network effects can produce concentration, but they do not guarantee permanent dominance. Regulation, interoperability, privacy constraints, technological substitution and user trust may alter competitive conditions. International businesses should avoid assuming that a globally successful platform is governed identically in every market.

5. Semiconductors and Technology Supply Chains

Semiconductors are foundational inputs for telecommunications, vehicles, industrial machinery, consumer electronics, defence systems and AI. The semiconductor value chain is geographically distributed. It includes research, chip architecture, electronic design automation, specialised manufacturing equipment, wafer fabrication, packaging, testing and distribution. No single country necessarily controls every stage.

This distribution creates strategic vulnerability. A disruption may result from conflict, export controls, natural disasters, energy shortages, water constraints, sanctions or commercial failure. Advanced chips are especially sensitive because they support high-performance computing, cryptography, military systems and AI training.

States use several instruments to protect or advance semiconductor interests:

• subsidies and tax incentives for domestic production;
• export controls on advanced chips and manufacturing equipment;
• investment screening and restrictions on technology transfer;
• alliances for research, standards and supply assurance; and
• stockpiling or diversification of critical inputs.

For firms, resilience requires more than finding a second supplier. Management should identify hidden dependencies in equipment, software, materials and logistics; distinguish single-source from single-region risk; test substitution options; and evaluate the time required to qualify an alternative component. Redundancy is valuable, but it can increase costs and create inventory obsolescence, especially in fast-moving industries.

6. Telecommunications and Infrastructure Competition

Telecommunications networks are strategic infrastructure because they carry economic transactions, government communications and military information. Competition may concern equipment vendors, spectrum allocation, undersea cables, mobile standards, cloud interconnection and satellite connectivity.

The debate over network vendors illustrates the tension between efficiency and security. A low-cost supplier may provide rapid deployment, while governments may worry about espionage, hidden access, political leverage or dependence on foreign maintenance. Security assessments must consider ownership, software update processes, legal obligations, supply-chain transparency and the ability to inspect or replace equipment.

Undersea cables carry most intercontinental internet traffic. They are vulnerable to accidents, natural hazards, fishing activity and deliberate interference. Cable redundancy reduces the impact of a single break, but routes may share geographic chokepoints. Businesses should understand whether their connectivity depends on a particular landing station, carrier or region.

Space systems increasingly support positioning, timing, communications, earth observation and financial synchronisation. Commercial satellite operators have become important actors in crisis response and military support. Risks include jamming, spoofing, cyber intrusion, debris, anti-satellite weapons and dependence on a small number of providers.

7. Surveillance, Intelligence and Human Rights

Digital surveillance includes the collection, analysis and use of information about people, devices, communications, locations and behaviour. States may use surveillance for counterterrorism, crime prevention, border management and public administration. Corporations may collect data for advertising, personalisation, fraud detection and product development.

Surveillance can improve security, but unchecked surveillance threatens privacy, freedom of expression, association and due process. It may also produce discrimination when datasets reflect historical bias or when proxies are used for protected characteristics. Facial recognition, predictive analytics and biometric identification are particularly sensitive because errors can affect liberty, employment or access to services.

Responsible governance requires a lawful purpose, necessity, proportionality, transparency, independent oversight, retention limits, security controls and meaningful remedies. Firms supplying surveillance technologies should conduct human-rights due diligence and assess foreseeable misuse. “Legal” does not always mean ethically acceptable, especially where institutions are weak or affected groups cannot challenge decisions.

8. Artificial Intelligence and Autonomous Systems

AI changes geopolitical competition by increasing the speed and scale of analysis, persuasion, targeting and decision support. States seek advantages in military planning, intelligence, logistics, cyber defence and economic productivity. Businesses use AI for forecasting, customer service, credit assessment, supply-chain optimisation and content generation.

Generative AI introduces risks of fabricated information, confidential-data leakage, intellectual-property disputes, bias and malicious automation. Autonomous systems create a further challenge: responsibility may become unclear when a system acts with limited human intervention. In military settings, debates concern meaningful human control, distinction between combatants and civilians, proportionality and accountability.

An organisation should govern AI through a lifecycle approach:

1. define the purpose and prohibited uses;
2. assess data quality, legality and representativeness;
3. test accuracy, robustness, security and bias;
4. document model limitations and decision rights;
5. monitor performance after deployment; and
6. provide human review, incident response and retirement procedures.

AI should be treated as a sociotechnical system. Model performance depends not only on algorithms but also on data, users, incentives, interfaces, organisational processes and political context. A technically accurate model can still produce harmful outcomes if its objective is poorly defined.

9. Digital Geopolitics and International Business Risk

International firms face at least seven categories of digital geopolitical risk:

A useful assessment process is:

Map: identify assets, suppliers, jurisdictions, data flows and critical dependencies.

Prioritise: estimate business impact, likelihood, substitutability and time to recovery.

Mitigate: diversify suppliers, segment networks, encrypt sensitive data, maintain offline backups, establish crisis communication and use contractual safeguards.

Monitor: track elections, conflicts, regulatory changes, sanctions, technology controls and threat intelligence.

Recover and learn: test continuity plans, investigate incidents and revise assumptions.

The objective is not to eliminate all dependence. Interdependence can create efficiency and mutual benefits. The objective is to ensure that dependence is understood, proportionate and manageable.

10. Illustrative Case: A Multinational Electric-Vehicle Manufacturer

Background

Consider a fictional company, GlobalDrive, which manufactures electric vehicles in three countries. Its vehicles depend on advanced processors, battery-management software, cloud services, satellite navigation and a mobile platform for customers.

Problem

A geopolitical crisis produces new export controls on advanced processors. At the same time, a cyberattack disrupts one cloud region, and a data-protection authority questions the transfer of vehicle telemetry to the company’s headquarters. GlobalDrive faces production delays, customer-service outages and possible regulatory penalties.

Analysis

The company’s risk is not a single cyber problem. It is an interconnected geopolitical exposure:

• processor restrictions affect physical production;
• cloud dependence affects digital operations;
• telemetry rules affect data governance;
• software concentration creates a platform dependency; and
• public claims about vehicle safety increase reputational sensitivity.

The company’s original supplier map identified direct suppliers but not the manufacturing equipment and software dependencies behind them. Its continuity plan assumed that cloud services were globally available, overlooking regional outages and legal restrictions on data movement.

Approach and solution

GlobalDrive establishes a cross-functional technology risk committee reporting to senior management. It qualifies a second processor design, redesigns selected components for substitution, and holds limited strategic inventory. It divides cloud workloads across regions and providers where technically and legally feasible. It classifies telemetry into safety-critical, operational and personal categories, applies data minimisation, and creates regional processing options.

The company also introduces network segmentation between manufacturing systems and corporate IT, offline recovery copies, supplier security requirements and an incident-exercise programme. Legal, engineering, procurement, privacy and government-affairs teams jointly monitor export controls and regulatory changes.

Outcome

The company cannot remove geopolitical uncertainty, but it reduces its time to recover and avoids treating one supplier or jurisdiction as permanently reliable. The cost of redundancy increases in the short term, while the expected exposure to prolonged shutdown and regulatory breach falls.

Learning points

1. Digital risk often crosses organisational boundaries.
2. Supplier concentration must be assessed beyond tier-one vendors.
3. Data localisation can require architectural change, not merely legal paperwork.
4. Resilience is a strategic capability with measurable operational value.
5. Government affairs, cybersecurity and supply-chain management should not operate in isolation.

11. Governance, Ethics and Best Practices

Effective digital governance combines law, technical controls and institutional accountability. Core practices include:

• maintain an inventory of critical assets and dependencies;
• use risk-based, least-privilege access controls;
• encrypt data in transit and at rest where appropriate;
• segment operational technology from general corporate networks;
• patch and replace unsupported systems;
• test backups and recovery rather than merely creating backups;
• conduct supplier and acquisition due diligence;
• document AI models, data sources and human decision rights;
• establish clear incident escalation and communication procedures;
• respect privacy, human rights and non-discrimination;
• monitor sanctions, export controls and changing technical standards; and
• participate in information-sharing arrangements where lawful.

International cooperation remains important. States and firms benefit from norms against attacks on civilian infrastructure, coordinated vulnerability disclosure, cybercrime cooperation, common technical standards and crisis communication channels. However, cooperation is difficult because major powers disagree about sovereignty, surveillance, internet governance and the legitimacy of offensive cyber operations.

12. Contemporary Strategic Developments and Limitations

Current competition is moving toward integrated “techno-economic statecraft,” in which trade policy, industrial policy, investment screening, standards, security alliances and research funding are used together. AI model access, cloud computing, quantum research, advanced packaging, satellite networks and digital currencies are likely to remain politically significant.

Several analytical limitations should be recognised. Technology does not determine political outcomes by itself; institutions and human choices matter. Claims about inevitable cyberwar may exaggerate the frequency or strategic effect of attacks. Localisation may improve political control but reduce efficiency and innovation. Redundancy can increase resilience but also raise prices. Regulation can protect rights while creating compliance burdens that advantage large firms. Finally, technical capability is not equivalent to strategic success: a state or company must connect technology to credible objectives, competent organisations and legitimate governance.

Chapter Summary

Digital geopolitics examines how technology, infrastructure, data and political authority shape international power. Cyber power includes offensive and defensive capabilities, intelligence, influence and technological dependence. Cyber conflict is difficult to attribute and often occurs below the threshold of armed war, making resilience and recovery as important as prevention.

Digital sovereignty concerns control over data, infrastructure and technological choices. Platform power arises from network effects, data, scale and control over access. Semiconductors, telecommunications, undersea cables and satellites are strategic assets because international production and communications depend on them. Surveillance and AI generate economic and security benefits but require privacy, human-rights and accountability safeguards. Autonomous systems raise difficult questions about responsibility and human control.

For international business, the appropriate response is not complete isolation. Firms should map dependencies, diversify critical inputs, secure networks, govern data flows, monitor regulatory and geopolitical developments, and integrate technology risk into strategy. Digital resilience is ultimately an organisational and political capability as well as a technical one.

Key Terms

Cyber power: The ability to pursue political, economic or security objectives through digital systems and information.

Cybercrime: Illegal digital activity conducted for financial or personal gain.

Cyber espionage: Covert acquisition of information through digital means.

Cyber sabotage: Deliberate disruption or damage to digital or digitally controlled systems.

Digital geopolitics: Study of how technology and digital infrastructure shape international power.

Digital sovereignty: Capacity to control digital infrastructure, data and technological choices.

Data governance: Rules and processes for collecting, accessing, transferring, protecting and using data.

Platform power: Influence arising from control of digital platforms, users, data and access rules.

Network effects: Increased value of a service as participation by users grows.

Semiconductor: Electronic component whose conductivity can be controlled and used in computing and devices.

Export control: Government restriction on the sale or transfer of specified goods, software or technology.

Supply-chain concentration: Dependence on a small number of suppliers, regions or technologies.

Telecommunications infrastructure: Networks and equipment that transmit voice, data and digital services.

Surveillance: Monitoring or collecting information about persons, communications or behaviour.

Artificial intelligence: Computational systems capable of performing tasks associated with human intelligence.

Autonomous system: System able to perform actions with limited direct human intervention.

Data localisation: Requirement or policy favouring storage or processing of data within a jurisdiction.

Cyber resilience: Capacity to prevent, withstand, recover from and learn from digital disruption.

Least privilege: Security principle granting users only the access necessary for their tasks.

Technology statecraft: Use of economic, regulatory and technological instruments to pursue national objectives.

Review Questions

Short Answer Questions

1. What is digital sovereignty, and why might a state pursue it?
2. Distinguish cybercrime from cyber espionage.
3. Why are semiconductors strategically important?
4. What are network effects?
5. Identify two ethical risks associated with digital surveillance.

Long Answer Questions

1. Explain how cyber power differs from conventional military power and discuss the problem of attribution.
2. Analyse the relationship between platform power, data accumulation and competition policy.
3. Discuss how telecommunications networks, undersea cables and satellites contribute to geopolitical influence.
4. Evaluate the benefits and risks of data localisation for an international business.
5. Explain how AI and autonomous systems create new governance and accountability challenges.

Analytical / Application Questions

1. A company relies on one cloud provider, one chip supplier and one cross-border data centre. Use the chapter’s risk framework to propose a resilience plan.
2. A government asks a technology firm to provide user data for national-security purposes. Analyse the legal, ethical and commercial issues the firm should consider.
3. An international manufacturer faces new export controls during a regional crisis. Identify the dependencies it should map and recommend immediate and long-term responses.

Multiple Choice Questions with Answers

Question 1

Which statement best defines digital sovereignty?

A. The complete elimination of all foreign technology

B. The capacity to control digital infrastructure, data and technological choices

C. The unrestricted growth of private technology platforms

D. The use of digital tools only for military purposes

Correct Answer: B. The capacity to control digital infrastructure, data and technological choices

Question 2

Which activity is most clearly an example of cyber espionage?

A. Stealing corporate secrets through unauthorised network access

B. Selling counterfeit products in a physical market

C. Destroying a factory with conventional explosives

D. Improving a firm's password policy

Correct Answer: A. Stealing corporate secrets through unauthorised network access

Question 3

If the probability of an incident is 0.05 and its estimated impact is $2,000,000, what is the expected loss?

A. $10,000

B. $50,000

C. $100,000

D. $400,000

Correct Answer: C. $100,000

Question 4

Why are semiconductor supply chains geopolitically sensitive?

A. Semiconductors are used only in household appliances

B. Their production is distributed across specialised and difficult-to-replace stages

C. They can be manufactured instantly by any firm

D. They have no connection to defence or communications

Correct Answer: B. Their production is distributed across specialised and difficult-to-replace stages

Question 5

What is a network effect?

A. A reduction in value as more users join a service

B. A legal requirement to localise data

C. An increase in service value as participation grows

D. A method of encrypting satellite signals

Correct Answer: C. An increase in service value as participation grows

Question 6

Which measure most directly supports cyber resilience?

A. Removing all system backups

B. Using offline recovery copies and testing restoration procedures

C. Giving every employee administrator access

D. Relying exclusively on one internet connection

Correct Answer: B. Using offline recovery copies and testing restoration procedures

Question 7

Which principle is most relevant to responsible surveillance?

A. Unlimited retention

B. Necessity and proportionality

C. Permanent secrecy from oversight bodies

D. Collection of all available data regardless of purpose

Correct Answer: B. Necessity and proportionality

Question 8

Why can data localisation create operational challenges for multinational firms?

A. It may require regional processing and changes to data architecture

B. It eliminates all privacy obligations

C. It guarantees unrestricted cross-border transfers

D. It makes cybersecurity unnecessary

Correct Answer: A. It may require regional processing and changes to data architecture

Question 9

Which is a key governance practice for high-impact AI systems?

A. Deploying models without monitoring

B. Avoiding documentation of training data

C. Providing human review and monitoring after deployment

D. Treating model output as automatically objective

Correct Answer: C. Providing human review and monitoring after deployment

Question 10

What is the principal strategic lesson of the GlobalDrive case?

A. Geopolitical risk can be managed only through complete self-sufficiency

B. Technology risks should be managed separately by each department

C. Mapping dependencies and building cross-functional resilience can reduce exposure

D. Cloud services eliminate the need for continuity planning

Correct Answer: C. Mapping dependencies and building cross-functional resilience can reduce exposure