1.6 The “digital chain sovereignty”

In fact, the whole computing chain has to be considered when some digital information is processed:

• Computer Hardware (CPU): on early 2016 it was revealed that new Intel x86s CPUs were incorporating an independant small CPU that served a dedicated TCP/IP server that could be used to manage the computer. As it is totally encrypted, only Intel engineers could manage it, and possible some US government security agencies such as the NSA. In fact, according to some technical studies, the whole x86 architecture is likely to have security and privacy concerns.
• Operating System and applications: kernel and various OS services and software applications that run on the top of the operating system. They can possibly relay some information to non-authorized systems or be infected by a virus that can act as a Trojan Horse and perform actions within the operating system or hardware.
• External APIs used by applications: when using an external API to get or process some information, the application is sending some non-sensitive or sensitive information to the API publisher, for instance: the user location. The API publisher can also restrict access to the API to some users or countries.
• Network hardware: WAN and LAN switches and routers, firewalls. Backdoors have been found on consumer and professional hardware, and the PRISM surveillance program is collecting and analysing a big part of the Internet traffic.
• Data contents: information is processed and is moving from place to place within the computer and outside the computer, using networks. Unencrypted or low-encrypted electronic documents are easy to spy.

In order to regain sovereignty on the whole digital chain, each piece of this chain has to be examined on their technical aspects and understood. Then, actions have to be taken to ensure that this digital chain won’t be taken over at some point by non-authorized parties:

• Computer hardware is maybe one of the most problematic issue because in some cases, it may be impossible to avoid some non-encrypted data to

  transit through the processor and eventually be catched by some independent processor parts like they exist in new Intel processors. Routine evaluation tests are needed to detect such cases. Regulation and laws are probably a way to explore to prevent these drifts. Open-sourced hardware designs can also be an option and could be encouraged by governments and regulation.

  • External APIs concerns are also difficult to address since they are external black boxes that can not be trusted unless you can deal with its publisher to access their source-code. Regulation and laws are probably a way to explore to prevent possible drifts. An option would be to provide alternate, independently and transparently operated APIs that would offer all guarantees.
  • Network hardware: routine evaluation is needed to detect issues. Impact on data privacy can be lowered a lot if data is heavily encrypted since collected data would normally be impossible to unveil its useful content. Anyhow, a real concern remains specifically with Internet routers that need to be upgraded very carefully with latest security patches to avoid possible large-scale takeovers or other abuses.
  • Data content: it is a key aspect of the “digital sovereignty”. If all the data was heavily encrypted from its source to its destination, all the surrounding infrastructure could be open to any wind with low risk of being hijacked, although useful information about “who is talking with who” could still be catched by a third-party. This is reasonably easy to achieve for data transit by using modern encryption algorithms with long keys. It’s more of a challenge to perform the same with the operating system or the processor when it comes to process the data. Difficult to compute 2+2 when operands and operator are encrypted.

  1.7 Conclusion

  In the modern world, where software and data will potentially be driving anything in a near future, a nation sovereignty cannot be restricted to territory questions such as land, air, sea property and frontiers, or to general regulation of the national activity. It has been demonstrated or is well admitted that many software pieces, including operating systems, include backdoors that can either be used to spy information on a system and send it to unauthorized parties, or be used by some unauthorized parties to take control of local or connected devices. Furthermore, nowadays, more and more third-party internet services (APIs) are integrated deeply in some modern OSes, and can be considered as fully part of them. Also some issues are suspected with networks and Internet, where massive amounts of data can be catched and analysed illegally by hackers and countries, breaking confidentiality of information at corporate or government levels. Even the computer hardware cannot be excluded from possible takeovers as there are some rising evidences that some modern CPUs include backdoors by design.

  Therefore, it appears clearly that the operating system, even in its modern form, can not be considered alone regarding the digital sovereignty question, as all parts of the digital chain in data processing and transit have to be care- fully examined and reinforced, technically speaking. A key aspect regarding operating system is the capability for their users to access and review all their source code. As a result, Open Source software, even if it does not offer a full guarantee for digital sovereignty, should be highly encouraged by governments, as well as open-sourced hardware designs for CPUs.

  Another key aspect of data privacy and integrity is encryption. Robust and proven encryption techniques and algorithms should be used and en- couraged to ensure data integrity when transiting over networks. In a modern democratic country, just like for regular mail service, it can be accepted that governments can intentionally break into some data in specific situations, when they have good reasons to fear some illegal activities. But a massive interception and analysis of all users, corporate and government data that is going through networks, just in case of a possible future benefits, should not be tolerated.

  It should also be highlighted that digital sovereignty concerns and security questions can only be understood and addressed by educated people with sufficient knowledge and expertise to understand them, in particular in case of cyberattacks, that need to by analyzed in depth very quickly to be defeated. This means that the quest to Digital Sovereignty could hardly go without a strong educational system.

  A strict regulation on these questions, at a world level, should also be brought to the negotiation table between nations in the future, as losing the digital sovereignty is a threat for all, comparable to nuclear weapons and climate change threats. As a particular case, EU nations should probably reinforce their links and work together as a single voice if they want to be heard and impose their views: it appears clearly that small nations have not enough power to negotiate against big blocks such as the USA, China or Russia, or even against the giant “GAFAM”[2] corporates. If EU nations could join forces and speak as only one voice, it would be easier to negotiate and suggest new models to ensure nation’s sovereignty, by emphasizing on Open Source software and hardware designs, strict Internet regulation, public and/or own standards on cryptography, and a balanced policy on privacy versus security. Proposing a civil-oriented approach, just like it was done with Galileo positioning system and doing a lot of pedagogy on these questions, would also probably help to gain support from the majority of Citizens and therefore make possible a move to an ambitious and new strategy regarding the data chain sovereignty.