Fiona van der Graaf

Digital sovereignty: the hard way or the highway?

The core message of the provided session transcript is that digital sovereignty is not an abstract policy slogan but a practical condition for institutional independence: an organization can only act autonomously if the infrastructure required to implement its decisions remains available under geopolitical pressure. The session opened by framing digital dependencies as a question of control, especially for international organizations in The Hague whose work depends on secure, resilient, cross-border information systems. The moderator introduced the discussion as a practical exploration of what digital dependencies and sovereignty mean, what they cost, and how leaders can turn the required change into an opportunity for boards, colleagues, and wider ecosystems. Osvaldo Zavala Giler, Registrar of the International Criminal Court, grounded the issue in the ICC’s experience after a serious, targeted, sophisticated cyberattack in September 2023 with an espionage objective. The court’s immediate response focused on operational containment: understanding the compromise, disconnecting systems, bringing in external expertise, working with Dutch authorities and state parties, and protecting victims, witnesses, staff, and judicial work. But after the immediate crisis, the decisive question shifted from “what happened?” to “what should we build next?” That shift turned a cybersecurity problem into a broader question of technological and institutional autonomy, tied directly to the court’s freedom to exercise its mandate independently. The ICC’s reassessment led to an IT security blueprint and initially toward large, proven technology providers, many from the United States, because they offered scale, tested products, interoperability, and sophisticated security capabilities. But the February 2025 United States sanctions framework targeting ICC judges and prosecutors changed the risk calculation. The issue was no longer only whether systems were secure, but whether they would remain available at all. A business impact assessment found that approximately 92% of the court’s judicial processes depended directly or indirectly on a US company or a company with a significant US nexus. Zavala Giler argued that efficiency and resilience are not the same: concentration can become a vulnerability when legal or geopolitical pressure threatens access. The ICC’s response, called Operation Tech Autonomy, aims to ensure that no single external dependency can prevent the court from carrying out core functions. Zavala Giler emphasized that sovereignty is not self-reliance but optionality: understanding critical dependencies, diversifying where necessary, and preserving credible alternatives. The court has already moved toward an open-source-based digital workspace in about six months, while acknowledging unresolved questions around interoperability and long-term support. He concluded by urging European investment in technology capacity and immediate activation of the EU blocking statute to protect European companies from extraterritorial effects of US sanctions. The provided transcript ends as the moderator thanks him, acknowledges Austrian diplomatic support, and prepares to continue with the expert panel.