The war in Iran has laid bare this threat in a way that governments had largely failed to anticipate. As the conflict spread beyond the traditional battlefield, attention quickly shifted from military targets to digital infrastructure, including data centers, cloud service providers, and technology platforms embedded in global supply chains.
Furthermore, the closure of the Strait of Hormuz threatened supplies of aluminum, helium, and liquefied natural gas (all of which are key raw materials in semiconductor manufacturing), and thus also cloud infrastructure, through which governments deliver basic public services.
This structural risk raises a fundamental question that governments are only beginning to consider: What exactly does sovereignty mean in an era of geopolitical turbulence and the concentration of power in the digital sphere?
At the heart of this discussion lies the digital infrastructure. India, Brazil, and Estonia have already demonstrated what can be achieved through well-designed digital systems: reducing corruption, expanding access to financial services, and radically improving the quality of public services. However, owning a mobile app is not at all the same as owning the infrastructure on which that app runs. Governments that ignore this distinction face four strategic risks.
Under Someone Else’s Control
The first risk is the illusion of control. Governments creating national digital services are usually confident that they are building strategic capabilities. But in reality, the key components of these capabilities (cloud computing, semiconductor manufacturing, artificial intelligence model infrastructure, telecommunications networks) are concentrated in the hands of a small number of private firms based in just a couple of countries. When one of these firms changes its rules and compliance requirements or is subject to export controls, the consequences can be profound and unexpected for the governments affected by these events.
A prime example is the dispute between Anthropic and the U.S. government. In early June, the administration of U.S. President Donald Trump ordered the company to suspend access for foreign users to its two most advanced artificial intelligence (AI) models, but just two weeks later, it lifted some of the restrictions. Authorities in countries around the world that have integrated Anthropic’s models into their systems have discovered that their digital potential depends on decisions made in Washington.
Second, success itself creates risks. India’s “Unified Payments Interface” (UPI) and Brazil’s instant payment platform Pix currently process hundreds of millions of transactions per day. Although these are remarkable systems, they have already become so deeply embedded in everyday economic life that a prolonged disruption in their operation would lead to more than just inconvenience for users. It would cause a breakdown in trade, delays in social payments, and—within just a few hours—a crisis in the country’s governance.
Yes, one might argue that these systems create efficiencies that outweigh the risks; that they can be supplemented with backup mechanisms; and that no government would deliberately shut down its country’s infrastructure. But the question is not whether governments will deliberately cause a failure in their critical systems; rather, it is whether the deep interdependence of technologies could trigger a failure that no one planned.
All these systems are tightly integrated, so a single failure is unlikely to remain isolated. In many countries, digital identification has now become the foundation of banking services, the administration of elections, telecommunications, tax administration, and social protection systems.
The third risk is market concentration. Today’s global digital economy depends on a strikingly small number of providers of cloud services, foundational AI models, operating systems, chip developers, and undersea cable operators. Such concentration creates enormous efficiency but, at the same time, unprecedented systemic risks. A geopolitical crisis, a cyberattack, or regulatory restrictions affecting just a handful of companies have repercussions for countries around the world.
Unfortunately, many countries only realized this after the fact. By creating advanced digital government services while outsourcing the infrastructure on which these services rely, they have essentially digitized the public sector but handed over its “nervous system” to foreign entities.
Finally, there is the state itself. Digital identification systems and payment platforms do more than simply automate public administration. By centralizing information, decision-making, and operational authority, they redistribute power within the state. Without reliable legal protections and independent oversight, the very infrastructure that delivers social benefits can become a tool for isolation, surveillance, and political control.
Independence, Transparency, and Accountability of the Digital Identity System
Trust in the DCI cannot be added after it has already been built. Trust must be built into its architecture from the very beginning. Governments that neglect these fundamentals are not merely ignoring risks—they are creating them.
None of this in any way diminishes the value of the Digital Infrastructure. But for the hopes placed on this infrastructure to be realized, a broader understanding of what constitutes a successful digital transformation is required. On the technical front, governments should build systems capable of withstanding the failure of any individual component through federated approaches, interoperability, redundancy, and offline resilience.
At the institutional level, digital infrastructure regulators must be genuinely independent, transparent, and accountable. Advisory committees without the authority to intervene cannot replace meaningful oversight by legislative bodies, civil society, and external auditors.
Geopolitical events over the past few years have turned infrastructure into a sphere of strategic competition, and digital systems are no exception. They were created to deliver public services but have now become the foundation of state power and geopolitical influence.
As they build digital public infrastructure, authorities must understand the dependencies they are creating and the risks that accompany them. A nation’s digital foundation is no longer merely an administrative issue. It is a matter of national security, and it should be treated as such.
Tariq Malik,
former chairman of Pakistan’s National Database and Registration Authority, former chief technical adviser to the United Nations Development Program.
© Project Syndicate, 2026.
www.project-syndicate.org
