 For years, China and Russia argued that the Internet was fundamentally American.Their case rested on a simple proposition: critical parts of the network depended on institutions, companies, and infrastructure ultimately subject to U.S. jurisdiction. If push came to shove, they argued, Washington could exercise control over the Internet in ways no other government could.
The United States spent decades proving them wrong. The most powerful example came in 2016 when the U.S. government completed the transition of stewardship over the Internet Assigned Numbers Authority (IANA) functions to the global multistakeholder community. Washington voluntarily gave up a privileged role in one of the Internet's most important coordination mechanisms. It was a remarkable act of restraint. At a moment when concerns about American dominance were growing, the United States chose trust over control. The message was clear: the Internet was not an instrument of American power but a global resource governed through shared stewardship. That decision helped preserve confidence in the Internet as a platform for global collaboration and reinforced the idea that participation would not depend on nationality, political alignment, or geopolitical loyalty. Most importantly, it strengthened one of the Internet's least understood but most important characteristics: its security model. The Internet became secure not because any one country controlled it, but because no country did. Cybersecurity has always been a collaborative enterprise. Vulnerabilities discovered in one part of the world are routinely shared with others. Researchers cooperate across borders. National computer emergency response teams exchange threat intelligence. Companies disclose weaknesses, coordinate patches, and work together to prevent attacks from spreading. Security researchers in Europe help protect systems in the United States while American researchers help secure networks in Asia. Knowledge moves quickly because threats move quickly.The principle is simple: the more people looking for vulnerabilities, the safer everyone becomes. Consider the banking sector. Modern financial institutions rely on globally interconnected software, cloud services, authentication systems, and communications infrastructure. A vulnerability discovered in a European bank may affect institutions in North America, Asia, and Africa. If a researcher identifies a flaw in a widely deployed authentication system, sharing that information allows banks around the world to patch their systems before criminals can exploit it. This is how much of modern cybersecurity works. Security is not achieved because every institution independently discovers every vulnerability but because knowledge circulates. The recent U.S. decision forcing Anthropic to suspend access to some of its most advanced AI models for foreign nationals introduces a new and potentially dangerous dynamic into this ecosystem. The immediate debate has focused on artificial intelligence and export controls but the broader significance lies elsewhere. For the first time, the United States has demonstrated its willingness to restrict access to a globally relevant digital capability based primarily on nationality. Whether the security concerns behind the decision are justified is almost beside the point. What matters is the precedent. A kill switch now exists. Not a kill switch for the Internet itself, but a kill switch for increasingly important components of the digital ecosystem. That matters because advanced AI systems are rapidly becoming security tools. They can help identify vulnerabilities, analyse malicious code, detect attack patterns, and accelerate defensive research. Restricting access to such capabilities does not merely affect the organisations being denied access but also the broader security environment within which everyone operates. The consequences are unlikely to be immediate or dramatic; the danger is more subtle. Security depends on visibility. The more trusted actors examining systems, the more vulnerabilities are found before attackers discover them; the more researchers participating in security ecosystems, the greater the collective understanding of emerging threats; and, the more organisations contributing knowledge, the stronger the overall defensive posture becomes. When participation narrows, visibility narrows. The result is not necessarily insecurity but reduced collective awareness as fewer vulnerabilities are discovered, fewer weaknesses are identified and, fewer perspectives contribute to understanding threats that increasingly affect everyone. This is particularly important because cyber threats themselves are fundamentally international. A ransomware group operating from one jurisdiction can target victims across dozens of others. A vulnerability discovered in California can affect hospitals in Germany and banks in France. The software supply chains underpinning modern economies are global by design. The response to such threats has historically been global as well. Yet, the introduction of geopolitical restrictions into this collaborative ecosystem risks changing that logic. Access to security capabilities may increasingly become a function of nationality rather than expertise, trust, or shared interest. For Europe, this development should be impossible to ignore. Substantively, discussions about technological sovereignty often revolved around industrial policy, economic competitiveness, or strategic autonomy. Critics frequently dismissed sovereignty initiatives as protectionist exercises searching for a justification. Those arguments have become harder to sustain. The Anthropic decision provides a concrete example of what strategic dependence looks like in practice. A government in Washington can make a political decision that immediately affects access to critical digital capabilities across Europe. The issue is not whether the United States remains a trusted ally but that dependence creates vulnerability regardless of who the partner happens to be. The lesson many European policymakers will draw is straightforward: if access to critical technologies can be restricted overnight, alternatives become a matter of resilience rather than economics. That conclusion will likely accelerate Europe's existing efforts around cloud infrastructure, semiconductors, digital infrastructure, and artificial intelligence. Technological sovereignty will increasingly be framed not as a commercial objective but as a security imperative. The geopolitical implications extend far beyond Europe. For more than two decades, China and Russia have argued that reliance on foreign technology creates unacceptable strategic risks. Their preferred solution has been greater state control over infrastructure, platforms, data, and networks. Western governments have long rejected that vision. They argued that security and resilience emerge through openness, interoperability, and distributed governance rather than state control. The strength of that argument rested not only on principle but also on practice. The United States could point to decades of restraint as evidence that global interdependence worked. The Anthropic decision weakens that position, however, it also does not prove that Beijing or Moscow are right. Their models remain centred on state control, censorship, and fragmentation. It does strengthen, however, a key element of their argument: dependence on foreign technology can create strategic vulnerability. Countries across the Global South are likely to notice. European policymakers certainly will. And China will undoubtedly point to the decision as evidence that critical digital technologies remain subject to American political authority. This is where the real danger lies. The existence of a kill switch changes behaviour even if it is rarely used. Governments begin planning for the possibility that access could disappear. Companies seek alternatives. Alliances become less important than self-sufficiency. Trust gives way to contingency planning. The result is not a more secure world. The Internet's greatest achievement was not simply connecting networks. It was creating a framework within which cooperation became more valuable than isolation. Security improved because knowledge crossed borders and risks were managed collectively because threats were shared collectively. If countries increasingly conclude that access to critical digital capabilities can be withdrawn for geopolitical reasons, they will inevitably invest in separation rather than collaboration. That may produce greater sovereignty but it will almost certainly produce less security. Comments are closed.
|